CVE-2024-21534 — Vulnerability in org.webjars.npm:jsonpath-plus —...

CRITICAL

JSONPath Plus Remote Code Execution (RCE) Vulnerability

Published October 11, 2024Updated September 10, 2026Source: osv

Summary

Versions of the package jsonpath-plus before 10.0.7 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node. **Note:** There were several attempts to fix it in versions [10.0.0-10.1.0](https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0) but it could still be exploited using [different payloads](https://github.com/JSONPath-Plus/JSONPath/issues/226)

Advisory Timeline

First published October 11, 2024 (731 days ago).
Last revised September 10, 2026 — 699 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

npm

Update jsonpath-plus to 10.2.0 or later

npm install jsonpath-plus@10.2.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 2 ecosystems: maven (1), npm (1).

Package	Ecosystem	Affected	Fixed In
org.webjars.npm:jsonpath-plus	maven	3.0.0, 4.0.0, 6.0.1	Range-based data available
jsonpath-plus	npm	All versions	10.2.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-94
Code InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2024-21534?: JSONPath Plus Remote Code Execution (RCE) Vulnerability This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2024-21534?: CVE-2024-21534 affects org.webjars.npm:jsonpath-plus and jsonpath-plus. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-21534 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-pppg-cpfq-h7wr

Related CVEs

CVE-2025-1302
HIGH
JSONPath Plus allows Remote Code Execution
CVE-2019-11358
MEDIUM
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
CVE-2021-41182
MEDIUM
XSS in the `altField` option of the Datepicker widget in jquery-ui
CVE-2021-41184
MEDIUM
XSS in the `of` option of the `.position()` util in jquery-ui
CVE-2020-11022
MEDIUM
Potential XSS vulnerability in jQuery
CVE-2022-31160
MEDIUM
jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label
CVE-2016-7103
MEDIUM
jQuery-UI vulnerable to Cross-site Scripting in dialog closeText
CVE-2021-41183
MEDIUM
XSS in `*Text` options of the Datepicker widget in jquery-ui

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies